[initializer] Fix issue with publicly signed SCM's on a self-signed Gitpod instance #10280
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
/werft run publish-to-kots 👍 started the job as gitpod-build-tar-certs.1 |
|
/werft run publish-to-kots 👍 started the job as gitpod-build-tar-certs.3 |
|
/werft run publish-to-kots 👍 started the job as gitpod-build-tar-certs.5 |
Pothulapati
changed the title
GIT_SSL_CAINFO with GIT_SSL_CAPATH
|
/werft run publish-to-kots 👍 started the job as gitpod-build-tar-certs.6 |
Fixes #10173 Using `GIT_SSL_CAPATH` means that we will continue to support publicly signed SCM's even when we have a `customCA` configured. Signed-off-by: Tarun Pothulapati <[email protected]>
|
/werft run publish-to-kots 👍 started the job as gitpod-build-tar-certs.8 |
|
/werft run publish-to-kots 👍 started the job as gitpod-build-tar-certs.9 |
github-actions
bot
added
team: delivery
corneliusludmann
approved these changes
May 30, 2022
csweichel
approved these changes
May 30, 2022
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
As per the issue, Using only
GIT_SSL_CAINFOseems to prevent thegit intializer from reading any of the default certs from the system's trust root
causing problems with publicly signed SCM's.
Though, I couldn't find any documentaiton specifying this but the behaviour
seems to be that as per various issues in discord, etc and my own testing.
Setting only
GIT_SSL_CAPATHto/etc/ssl/certsseems to cause problemswith self-signed SCM's even if the certificate is under
/etc/ssl/certs. It throwsthe same
unknown self signed certificatewhich means it is not at all readingthe custom cert and probably only reading the
certs.pembundle.Setting them both i.e
GIT_SSL_CAINFOto the custom cert, andGIT_SSL_CAPATHto the default cert trust store seems to be the only way to get both publicly signed
and self signed SCM's to work.
Signed-off-by: Tarun Pothulapati [email protected]
Related Issue(s)
Fixes #10173
How to test
Spin up a self-signed
gitpodinstance, and authenticate it withboth a
self-signedSCM and a public SCM.An Instance up and running at tarun.gitpod-self-hosted.com
Release Notes
Documentation